-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat Single Sign-On 7.5.1 security update Advisory ID: RHSA-2022:0449-01 Product: Red Hat Single Sign-On Advisory URL: https://access.redhat.com/errata/RHSA-2022:0449 Issue date: 2022-02-07 CVE Names: CVE-2021-4104 CVE-2022-23302 CVE-2022-23305 CVE-2022-23307 ===================================================================== 1. Summary: A security update is now available for Red Hat Single Sign-On 7.5 from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: Red Hat Single Sign-On 7.5 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. This release of Red Hat Single Sign-On 7.5.1 serves as a replacement for Red Hat Single Sign-On 7.5.0, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Security Fix(es): * log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender (CVE-2022-23305) * log4j: Unsafe deserialization flaw in Chainsaw log viewer (CVE-2022-23307) * log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender (CVE-2021-4104) * log4j: Remote code execution in Log4j 1.x when application is configured to use JMSSink (CVE-2022-23302) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 3. Solution: Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. The References section of this erratum contains a download link (you must log in to download the update). 4. Bugs fixed (https://bugzilla.redhat.com/): 2031667 - CVE-2021-4104 log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender 2041949 - CVE-2022-23302 log4j: Remote code execution in Log4j 1.x when application is configured to use JMSSink 2041959 - CVE-2022-23305 log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender 2041967 - CVE-2022-23307 log4j: Unsafe deserialization flaw in Chainsaw log viewer 5. JIRA issues fixed (https://issues.jboss.org/): CIAM-2054 - [log4j 1.x] One-off patch for RH-SSO 7.5.1 ZIP distribution 6. References: https://access.redhat.com/security/cve/CVE-2021-4104 https://access.redhat.com/security/cve/CVE-2022-23302 https://access.redhat.com/security/cve/CVE-2022-23305 https://access.redhat.com/security/cve/CVE-2022-23307 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=core.service.rhsso&downloadType=securityPatches&version=7.5 7. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYgIBcdzjgjWX9erEAQj1Tw/+O0XV6L+JHOhMB4a9y41Xb4+FpY1iBxSN 7Pq8wZhbDhlHAh+cWQRQcsR+L5SbJuUEizZ4Qmh9CsMKbBEpoMkr8nAGt9+l+D2x 4StQ1J8+Iunffd7oSyFhU9hMHmZu/s7hjBDyh7loA7DzNEWDJg6siFdw4Ye3PbYr ikoj0Hvs9HnPWlRGVEj44HPkxC06WuNpqdy5JA2v+OeBqX+XY8zwb1KnbHw36hxE zOH8PH2jBKE9Z1Nai3A3BGBJf6FFWWVSAvwsV4rdRsfC6NENJ80r8rmcmERF0p4q sBZH7Pll6Ma18jwZC4j1RSstmxCZmP0kOGOWwkpFX+GWyxPRe3rVB6/YP7Rw9tFT YnXNZCiQzj3vishlOBVJ7z+9DCcxLoRA2FTkVvINGK13jp7wVL5nKIT0v/hVmikc 1K9wZjKY4UsUBkk20C5hw+idUvJprFbcm3px2OSaqFSs/YMbDJke7EwuY9QkXA5q PGj9fDps7dP84niYov0LGy4CHidC7ah5lpTIqZqW8r2/6OKaaakMGFJZpHZO5Tqu gSHkp9zg0ojFlQpXG0RZhyhlxcJGb9i6KEtL3k0K5g9KSvuJz3ECyBtetRmyOb4x 6rEaOFocHAeWpq3xnUoSckl0dnjn4DkZhtP592Q5R7V4FgoZJPxPT5R0U3gyNn9D AwM1HMaSO04= =NayV -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce